You have decided that it’s time to put in place an information governance plan. It’s a pretty big undertaking involving a combination of people, process and technology. It requires you to work with teams and departments across the organization and get agreement on everything from data vocabularies and taxonomies, to information ownership and the information lifecycle. You also need to define a set of technologies to support your strategy. It’s going to take a lot of time.
In the meantime it’s business as usual. New privacy regulations are put in place, new applications are purchased, new companies acquired and merged. You can’t wait for an overall information governance strategy to be put in place.
From Reactive to Proactive
GDPR has shaken a lot of US companies, not because it affects them directly necessarily, but because it is driving a wider discussion on the question of privacy. Ken Lownie, Everteam’s COO, said that we are seeing a lot of reactive changes happening and they aren’t all strategic.
A lot of companies are starting to ask questions about how they are handling sensitive information. Do they know where all their PII content is located? Can they quickly respond to customer requests?
GDPR is a sounding bell, letting you know that there are things you should be doing to shift to a proactive view on privacy and compliance. There are things you can do today that don’t require the full governance strategy to be in place.
That’s why we talk about an information governance technology framework. Combined of a set of technology solutions and associated processes, this framework can help work on governance projects that feed into the overall strategy. With the framework, Ken said you don’t have to wait until the full strategy is set up. Use it to attack basic use cases or projects that you need to deal with now and feed the results of that project back into the overall strategy.
An Information Governance Technology Framework
An information governance technology framework (IGTF) offers a consistent approach to execution and a consistent set of reusable tools and technologies that can work together to support a use case or project. We look at this framework as a middle layer between the strategic initiative and the projects.
There are five key steps in the framework: Connect, Discover, Organize, Migrate and Manage. We’ve talked about this steps and the framework before, but have updated it after working and talking with companies facing governance challenges.
Connect: No matter the use case or project, you will have to connect to one or more information repositories. The idea is to have a standard, repeatable approach to connecting, using open standard and tools. You many need to connect file shares, SharePoint, Office 365, business applications, structured data in databases, or some other repository.
Can you connect once and use it for all your projects? Yes, but think of this as more of a staged initiative. Start with a pilot that connects to a repository to index and catalog a specific content type, or all content for a specific group or department. Once that project is completed, expand your indexing and cataloging to other content types or departments.
Discover: This is where you find out what is in those repositories you connected to. You will identify metadata and file properties, PII, PCI and other confidential information. Discover helps you find the ROT (redundant, obsolete, trivial) content and technology like natural language processing and named-entity extraction will allow you to conduct searches for specific companies or people and add that information to the metadata.
Organize: Now you know what you have, it’s time to get your information organized. AI technology saves a lot of manual effort helping you classify your content. Classify not only by metadata and file properties, but also by the content itself. Once your information is organized properly, you can invoke workflow processes to take action on certain types of information.
For example, you have classified a number of documents as ROT. Before you go ahead and delete them, you want someone to review and approve the action. So you set aside those files and kick off a workflow that notifies a reviewer to look at them. Once reviewed and approved for deletion, the workflow process will delete the file and create an auditable trail for defensive destruction.
There are a few tools available to help you discover information in your repositories and systems, some will even help with the organization, but there is still a lot of manual effort. Ken suggested that you focus on two dimensions:
- Leverage available AI technologies to help with organizing your information. His favorite saying lately has been “computers got us into this mess and computers will get us out.”
- Connect the steps. Most file analytics solutions focus on discovery but there is a lot more to do. You need a framework that will take you to the next step, which is to organize and clean the information.
Manage/Migrate: We show them in the framework as two separate steps, but sometimes they are merged together. Migrating is moving the information to a new location – a new application, a permanent archive, etc.. But in some cases you don’t want to move them. In this case, you manage them in place.
Some information will require formal records management whether you move them to a records management system or manage them in place.
When to Apply the Framework
We talk a lot about applying the framework to projects, but you can use it in many ways. Consider a process where an employee leaves the company or moves to another department. You will want to know what information they have stored on their laptop, network file share or Office 365, and you will want to do something with that information. This is a repeatable process that works well with the framework.
You can initiate a project to set up a standard way to monitor and manage file shares, then turn it into a repeatable process you run on a regular basis. The important thing is that you don’t need to wait for a strategic initiative to do something different today. But you do need to ensure that whatever you do reports into the strategic initiative to ensure alignment going forward.